internal/

- secretsreconcile — the level-triggered reconcile loop.

Package canary is the epic-71 / 0c production canary (#1312, metrics-only): a per-workspace-class probe runner that turns "stale prompt / silent click / wedged session" into counters and histograms while the wave fixes land.

Package contractstream is the API-side on-demand proxy of a pod's ABI contract stream (US-69.10, design 0055 S3/D1-B): one upstream connection per workspace while ≥1 browser subscriber is attached, fanning raw StreamFrames out to every subscriber.

Package database — query tracer.

Package email provides the orchestration layer for outbound transactional email.

Package health runs the API server's periodic dependency health probe.

Package inbox implements the unanswered-question inbox (#1313, epic-71 stream 3a): the outbox's sibling for inbound asks.

Package keyrewrap is the US-70.4 login-independent re-wrap reconciler (design 0052 §4.5 item 5, issue #1208).

Package outbox implements the D3 durable-prompt outbox (design 0050, #907): accept-then-deliver decoupling so a client disconnect can never lose an accepted message.

Package passkey implements WebAuthn / FIDO2 passkey registration and login (Epic 59) plus the one-time-use recovery-code fallback for passkey-only users.

Package secretsreconcile is the level-triggered secrets-delivery reconcile loop (US-70.3, epic #1158 laws 2/4).

Package sessionalerts persists D6 (#998) hung-session escalations to the session_alerts table.

Package sso implements OIDC single sign-on for organizations (US-43.10, D17).

Package usagestream is the API's busy-gated consumer of a pod's ABI contract stream (US-69.11, design 0055 S3 + D1-B + the owner's billing disposition): while any session of a workspace is in flight, the API holds ONE subscription to the pod's event stream and derives —

Package wsstate holds the per-workspace state that ProxyHandler previously kept in process-local maps.